"I have internet" and "my lookups are private" are separate claims. A working tunnel with DNS still going to your ISP is a very common combination.

A three-minute self-test

  1. Open dnsleaktest.com or browserleaks.com/dns and run a test. If the servers it lists carry your broadband provider's name, you have a leak.
  2. Look at the domain column on the Connections page. Full domain names rather than bare IP addresses mean resolution is happening inside Clash, which is what you want - see The Connections Page.
  3. On the command line, nslookup www.example.com queries the adapter's DNS server and ignores the system proxy entirely, so this step only tells you something under TUN mode.
Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

What is normal under fake-ip

In fake-ip mode the browser receives a reserved address such as 198.18.x.x, and the real lookup happens at the far end when the connection is established. Test sites may therefore list no DNS server at all, or list a resolver in the node's country. Both are expected - the mechanism is described in Custom DNS: fake-ip and redir-host.

Plugging the leak

  • System proxy without TUN. Anything that is not a browser resolves names on its own. That is the design, not a bug - full coverage requires TUN.
  • dns.enable is false. The core is not handling DNS at all. Turn it on.
  • Your ISP's resolver is in nameserver. Replace it with an encrypted or public resolver rather than whatever DHCP handed you.
  • The browser runs its own secure DNS. Chrome and Firefox can resolve over DoH regardless of system settings. If the test reports Cloudflare or Google and you never configured that, this is why.
Side note: if you only want to confirm the proxy itself is working, there is a simpler route - see Enabling and Verifying the System Proxy.